Rust advisories / scaly
Unsound HighRUSTSEC-2026-0080 · scaly
RUSTSEC-2026-0080: Multiple soundness issues in `scaly` safe APIs
Short answerscaly has an API that can cause undefined behaviour from safe code: Multiple soundness issues in `scaly` safe APIs. No fixed version yet.
| Crate | scaly |
|---|---|
| Type | Unsound |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | High (GitHub rating) |
| Published | 2026-01-19 |
| Last changed | 2026-04-05 |
| Also known as | GHSA-2c6h-4899-wjxr |
What to do
- Find who pulls it in:
cargo tree -i scaly. - Avoid the affected API, or replace the crate.
Details from the advisory
Affected versions contain multiple safe APIs that can trigger undefined behavior:
Array<T>::indexcan perform an out-of-bounds read.String::get_lengthcan perform an out-of-bounds read.String::append_charactercan perform an invalid write.String::to_c_stringcan perform an out-of-bounds write.
These issues were reproduced against scaly 0.0.37 under Miri. And the crate is unmaintained.
References
- Package: crates.io/crates/scaly
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0080.html
- Report: github.com/rustsec/advisory-db/issues/2594
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?